SB20260824213 - Always-Incorrect Control Flow Implementation in Linux kernel overlayfs

Description

This security bulletin contains information about 1 vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-74619)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of a user namespace mismatch in ovl_fill_super() when completing an overlayfs mount context from another user namespace. A local user can pass a crafted fscontext file descriptor between namespaces and repeatedly issue FSCONFIG_CMD_CREATE to cause a denial of service.

The issue can be triggered without special capabilities by using separate user and mount namespaces, and repeated triggering can taint the kernel, flood system logs, or panic systems configured with panic_on_warn.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/42d99fcd8006007e2f708bede6789f37f3910b30
• https://git.kernel.org/stable/c/494346f2aab2489d379d43ff614aea447cf4e94d
• https://git.kernel.org/stable/c/513478092966dc9818d96dd2b3ed613fd2f6e30e
• https://git.kernel.org/stable/c/63981fc786daaa626cb14d9be1406f674d79f98f
• https://git.kernel.org/stable/c/be161fa31e3e9cc828a3c1bd935edca461e8a7a1